CVE-2026-16612

CVE-2026-16612 affects the FiboSearch WordPress plugin prior to version 1.34.1 . The plugin fails to consistently exclude password-protected products from two unauthenticated AJAX endpoints : the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result...

CVE-2026-16612 FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

EUVD-2026-64217

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints, allowing unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two...

EUVD-2026-63822

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19085 Copy & Delete Posts < 1.5.6 - Author+ Password-Protected Post Content Disclosure

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable...

CVE-2026-19085

The Duplicate Post WordPress plugin before 1.5.6 lacks an authorization check before duplicating a post. A user with a delegated role can exploit this to republish another user's password-protected post as publicly readable, resulting in a content disclosure. The vulnerability requires high privi...

PPLdump

PPLdump ⚠️ 2022-07-24 - Depuis Windows 10 21H2 10.0.19044.1826 mise à jour de juillet 2022, l'exploit implémenté dans PPLdump ne fonctionne plus. Un correctif dans NTDLL empêche désormais les PPL de charger des Known DLLs. Plus d'informations ici. Cet outil implémente un exploit userland qui a été...

EUVD-2026-63539

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.setvalue in frappe/client.py checks a dictionary supplied through the fieldname parameter against forbidden standard and child-table fields before parsing the dictionary into individual field names. An...

CVE-2026-20359

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20359

CVE-2026-20359 affects Cisco Crosswork products, classified as a CWE-522 (insufficiently protected credentials) issue discovered during an internal security review. CVSS 3.1 scores it 9.9 CRITICAL (network vector, low privileges required). No specific affected component, version, or patch details...

EUVD-2026-62564

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/userid in api/api/controllers/securitycontroller.py passes request.get"user" instead of request.context'tokeninfo''sub' as currentuser...

CVE-2022-46484

CVE-2022-46484 Data Illusion Survey Software Solutions NGSurvey v2.4.28 및 이하 버전의 비밀번호로 보호된 설문조사에서 정보 공개 취약점으로 인해, 공격자가 설문조사에 접근할 비밀번호를 확인하고 설문조사를 임의로 제출할 수 있습니다...

CVE-2025-29927_demo

CVE-2025-29937 Шаги воспроизведения root@kitploit: npm i npm run dev curl -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware" http://localhost:3000/protected...

CVE-2025-11729

The PPWP: Password Protect Pages, Posts & Full or Partial Content plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the canaccess function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with...

ROS-20260819-73-0043

The vulnerability in Tomcat11 is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

BIT-GITLAB-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

CVE-2026-72281

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for arm64 architectures. This vulnerability involves an issue with memory accounting for protected guest faults. During the teardown process, the system may incorrectly manage long-term memory pins, potentially leading to...

CVE-2026-71858

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

CVE-2026-71858

Notepad++ prior to 8.9.7 is vulnerable to an HMAC bypass in its macro system. Macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation normally applied to UserDefinedCommands, allowing invocation of Scintilla actions and the internal Open in Default Viewer command within...

CVE-2026-14564

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...